CVE-2026-73257
CriticalCVSS 9.1Summary
A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to send an HTTP request with both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks accept both headers and prioritize chunked encoding, leading to CL.TE desynchronization and request injection in another user's context.
Risk Assessment
The risk includes unauthorized access or modification of resources in another user's context, potentially leading to data confidentiality and integrity breaches.
Recommendation
Upgrade Mongoose to version 7.22 or later, which includes the fix.
Original NVD description (English source)
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.